feat: add call_a2a_agent MCP tool for outbound A2A protocol calls

[vybe]

Summary

Add a new `call_a2a_agent` MCP tool that lets any Trinity agent call an external A2A-compatible agent (Google ADK, LangChain, AWS Bedrock, etc.) using the Agent2Agent v1.0 protocol. Trinity agents can delegate to agents on other frameworks without custom per-framework integration code.

Context

The A2A protocol (Apache 2.0, Linux Foundation / AAIF) is now supported by 150+ organizations including Google, Microsoft, and AWS. Any agent exposing `/.well-known/agent-card.json` + a JSON-RPC endpoint is callable. This is the lowest-risk entry point for A2A in Trinity: client-only, no changes to agent-server, no inbound surface. See `docs/research/a2a-protocol.md` § 13.2 Option C.

Acceptance Criteria

• New MCP tool `call_a2a_agent(agent_card_url, message, context_id?, stream?)` in `src/mcp-server/src/tools/`
• Fetches Agent Card from `/.well-known/agent-card.json`, validates A2A v1.0 schema
• Authenticates using Bearer token stored in calling agent's `.env` (key looked up by agent card domain)
• Calls `SendStreamingMessage` via SSE; streams token chunks back to the calling agent
• Maps `TASK_STATE_INPUT_REQUIRED` to a blocking prompt in the current chat session
• Long-running tasks (async): stores A2A `taskId` in Redis keyed `a2a:task:{taskId}`, returns execution_id for polling via existing `get_execution_result`
• Audit log entry for each outbound A2A call (actor: calling agent, target: agent_card_url)
• Respects `agent_permissions` — calling agent must have outbound A2A permission enabled (new permission flag or reuse existing mechanism)
• Unit tests covering: card fetch, auth negotiation, streaming response, INPUT_REQUIRED handling, error codes

Technical Notes

• A2A v1.0 method names are PascalCase (`SendMessage`, `SendStreamingMessage`); v0.3.0 used slash-separated (`message/send`). Target v1.0 only.
• Auth: most public A2A agents use Bearer JWT or API key. Agent stores credential as `A2A_{DOMAIN}_TOKEN=...` in `.env`; tool resolves by matching card URL domain.
• Related files: `src/mcp-server/src/tools/chat.ts`, `src/backend/services/task_execution_service.py`
• Reference SDK: `a2a-python` (Apache 2.0) at https://github.com/a2aproject/a2a-python